What We Send, and What We Keep

✓ The Short Version

• ✓ Tests run in your browser. By default the results never leave it.
• ✓ We store a result only if you tick the share box after a test. It is unchecked every time.
• ✓ Your IP address is never written to our database - not even when you do share.
• ! Google Analytics runs on this site, through Google’s Site Kit plugin and Tag Manager: it sets its own cookies and reports your visit to Google. No advertising cookies, no tracking pixels.
• ✓ Our own server counts page views - which page, which site linked to it, whether the page was then used - and how many tests are run, without your IP address and without a cookie. Kept 90 days.
• ✓ No accounts, no registration, no email address required for anything.
• ✓ We do not sell data. Shared results are published only as aggregates.

How Our Tests Work

All VPN tests run in your browser using JavaScript. Your browser makes direct requests to third-party public APIs, and the results are displayed on the page and held only in the page’s memory. Closing the tab discards them.

Third-party services your browser contacts, each subject to its own privacy policy. Every one of them sees your IP address, because that is how a request reaches it; the ones marked on open are contacted as soon as the page loads, the rest only when you start a test.

• · www.googletagmanager.com, www.google-analytics.com - Google Analytics and Tag Manager, on every page (on open). They set cookies (_ga and similar) and report the visit to Google under Google’s own privacy policy
• · ipapi.co - country and network of your address, on What Is My IP (on open), proxy detection, the DNS checker and “Am I blocked?”
• · www.openstreetmap.org - the map on What Is My IP (on open), which is given the approximate position of your address to draw it
• · crypto.cloudflare.com - what your connection reveals during the TLS handshake, on What Your ISP Can See (on open)
• · api.ipify.org - your IPv4 address, in the “Your connection right now” panel on the home page (on open), the leak tests (VPN, DNS, WebRTC and IPv6), the quick VPN check, “Am I blocked?” and the “Am I connected to…” check on the provider pages, and every two seconds while the kill switch monitor runs. It has no IPv6 address, so it can only see IPv4
• · api64.ipify.org - your IPv6 address, if your connection has one, wherever api.ipify.org is asked except “Am I blocked?”
• · 1.1.1.1 (Cloudflare) - which country Cloudflare places you in, on the VPN identity test and the DNS checker
• · cloudflare-dns.com, dns.google, dns.quad9.net - encrypted DNS lookups, on the DNS checker, the email security check and “Am I blocked?”
• · SpamCop and Barracuda - “Am I blocked?” first asks each list, through Cloudflare’s DNS, for its own test entry (127.0.0.2); only a list that answers it is then asked about your IPv4 address, by a name built from the address, so Cloudflare and that operator receive the address itself as the question. Spamhaus and SORBS are not asked
• · speed.cloudflare.com - the speed test: the small requests it times for ping, the data it downloads, and the data it uploads
• · stun.l.google.com, stun.cloudflare.com - WebRTC STUN servers, which report back the public address your browser can be reached at; that is what the WebRTC checks compare
• · api.pwnedpasswords.com - the password check sends the first five characters of your password’s SHA-1 hash, never the password, and compares the rest in your browser

Server-Side IP Lookup

Some features need our server to see your IP address. Three places do it as they open, because showing it is what they are for: the “Your connection right now” panel on the home page, “What Is My IP” and “What Your ISP Can See”. Everything else does it only when you start it: the leak tests and the other checks that name the network you exit through (including “Am I connected to…” on the provider pages), and identifying which network a shared test result came from. In each case our server sends your IP to ip-api.com to look up the country and network operator, then uses the answer and discards the address.

A connection with both IPv4 and IPv6 has two addresses, and this site is reached over IPv6 whenever there is one - which says nothing about whether IPv4 goes through your VPN. So the home page panel, the VPN, DNS, WebRTC and IPv6 leak tests, the quick VPN check and the provider pages’ connection check read each address separately, from api.ipify.org and api64.ipify.org, and send both to our server in the body of the request, never in a URL. Each is looked up on its own and handled the same way: used for the answer, then discarded. When the kill switch monitor sees your IPv4 address change, it sends the address it started with and the new one the same way once you stop it, to tell another of your VPN’s servers from your own connection. If you share a leak test result, your IPv4 address is sent with it once more, so the result is filed under the network your VPN tunnel leaves from rather than the one this site happened to be reached over. A shared kill switch result carries the IPv4 address the monitor started with, for the same reason: by the time you share it, your VPN may still be down. It is handled the same way: the network is kept, the address is not.

The lookup result is cached for 30 minutes to avoid repeating the request, or for one minute when the lookup did not answer. That cache holds only the derived values - country, city, timezone, network operator and its number, and whether the address is listed as a datacenter or proxy - and never the address itself. The cache entry is filed under a keyed hash of your IP whose secret is replaced at the start of each day (UTC), so it cannot be matched against the previous day’s entries, and once the secret is replaced it cannot be worked backwards into an address. While a day’s secret is in use it sits in our database, so someone holding a copy of that database could recover an IPv4 address by trying every possible one - one more reason the address itself is never written.

The leak tests also measure which DNS resolvers answer for you. Your browser looks up a few one-off names under dns.vpnmeter.com; our own nameserver records the addresses of the resolvers that ask for them, and api.vpnmeter.com hands those back to the page and looks up each resolver’s network with ip-api.com. If you run your own resolver at home, that address is yours. They are kept for the ten-minute session, the network lookup is filed under a keyed digest with no address in it and kept no longer, and neither is written to a log.

Your IP is transmitted to ip-api.com as part of this lookup. If you would rather that did not happen, do not open the home page or those two pages, do not start those checks and do not share test results.

Shared Test Results (Opt-In)

After a test you may tick a box to contribute the result to our public VPN database. This is the only circumstance in which we store anything about a test. The box is unchecked on every run, its state is never remembered, and if you ignore it nothing is transmitted. Ticking it asks our server which network you exit through, to suggest the provider in the form; nothing is stored until you press “Submit result”.

What a shared record contains:

• · The test outcome - for example whether DNS leaked, or the measured speed and latency
• · The VPN provider, either the one you selected or the network operator behind your exit IP
• · The exit country and city of the connection, and the network operator’s name and ASN - for a leak or kill switch test, those of your IPv4 address, the one a VPN tunnel is judged by
• · Your browser family and operating system family - for example “firefox” and “windows”
• · A country code derived from your browser’s language setting
• · A random token generated for the browser tab, used to pair a no-VPN speed measurement with the VPN measurement that follows it
• · A keyed hash of your IP address, used to rate-limit abuse
• · Where your browser tab came from - the site that linked here, such as a search engine or an AI assistant, or “direct” - and the first page you opened in it

What it never contains:

• · Your IP address, in any form that can be read back
• · Any name, email address, account or persistent identifier
• · The websites you visit, your DNS queries, or the contents of your traffic

The hash mentioned above is an HMAC whose secret key is replaced at the start of each day (UTC) and the previous key discarded. It lets us spot twenty submissions from one source within an hour, and two records from the same person on different days cannot be connected. Once the day’s key is gone it cannot be reversed into an address; while it is in use, the same caveat as above applies to a copy of the database.

A shared result is kept out of every count and published figure when the network it came from contradicts it: a provider named for a connection that does not look like a VPN at all, or for another provider’s network, or a kill switch run that started outside a VPN. It stays in the database, uncounted.

Shared results are published only in aggregate, and only once a provider has at least 30 of them. Individual submissions are never displayed.

Legal Basis and Your Rights (GDPR)

Where a shared submission constitutes personal data, we process it on the basis of your consent under Article 6(1)(a) - the tick box. You are free not to give it, and every test works identically without it.

We deliberately hold nothing that lets us identify you or single out your submissions. That has a consequence worth stating plainly rather than hiding: we cannot retrieve, correct or delete an individual record on request, because we have no way of telling which one is yours. Under Article 11, a controller who cannot identify a data subject is not required to acquire additional information purely to enable that identification - and we are not willing to start collecting identifiers for that purpose, since doing so would make the situation worse for everyone.

If you withdraw consent, we stop processing going forward; already-submitted anonymous records cannot be singled out for erasure. Please take this into account before ticking the box.

You have the right to lodge a complaint with your national data protection authority.

Cookies and Browser Storage

VPNMeter’s own code sets no cookies. WordPress sets its functional cookies, the cookie consent banner records your choice, and Google Analytics sets its cookies (see above). We set no advertising cookies.

The speed test uses your browser’s sessionStorage to hold a random tab token, a no-VPN baseline measurement if you share one, and the latest run you marked VPN off and VPN on - speeds, ping, jitter and the time, nothing else - so the page can show them side by side after a reload. Every page also notes in sessionStorage where the tab came from and its first page; that note leaves your browser only as part of a result you choose to share. All of it lives only in your own browser, is cleared when you close the tab, and none of it is readable by any other site.

Our Own Visit Count

We keep a small log of page views in our own database, to learn which pages people use and what sends them here - a search engine, an AI assistant such as ChatGPT, or a link somewhere else. No third party receives it. For each page view it holds:

• · The page, without anything after the ? in its address, except a utm_source tag if the link carried one
• · The name of the site that linked to it, if your browser sent one - the site, not the page on it
• · Your country, as our CDN reports it
• · Whether it was a phone, or which desktop browser family - for example “mobile” or “firefox” - never the full identification string your browser sends
• · For automated visitors only, the crawler’s name - for example “Googlebot”
• · For people, a keyed hash of IP address and browser, with the same daily-regenerated key described above - it counts how many different people visited on a day, and cannot connect your visits on two different days
• · Whether the page was then used: the first time you touch, click, type, scroll with a wheel or move the mouse on a page, it tells our server so, once, sending only the page’s address. The server marks that page view, found by the hash above. This is how we tell people from programs that only download pages

It never holds your IP address, your browser’s user agent string or a cookie. Entries are deleted after 90 days.

Separately, we count for each test page and day how many times a test was started, how many runs ended with the option to share a result, and how many results were shared. Those are totals and nothing else: no hash, no address, nothing about who. Signed-in users and automated visitors are not counted, and the totals are deleted after the same 90 days.

Hosting & Server Logs

Separately from anything described above, our web server and its CDN keep standard access logs - IP address, browser user agent, pages requested - as every web server does, for security and uptime. These logs are:

• · Retained for a maximum of 30 days, then deleted
• · Never linked to test results or to shared submissions
• · Not shared with third parties, and not used for advertising or profiling

No Affiliate Links

We carry no affiliate links and earn no commission from VPN providers.

Test results, lab figures and the ordering of providers in our results database come from measurements, which we neither sell nor accept payment to alter. If that ever changes, this page and the page in question will say so first.

Questions

For anything about this policy or our data practices, get in touch:

Contact Us

Changes to This Policy

We may update this policy if our practices change. The date at the top reflects the last update. If we ever change what a shared result contains, this page changes in the same release.